{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreiam6ulprwdtsfjgpmxdujndu72b3jjbmgeb3cmw3qjbavjhg4767e",
    "uri": "at://did:plc:xxrzfynfiasdpbxteqxi4jgq/app.bsky.feed.post/3mhmdsmdppyc2"
  },
  "description": "Microsoft Purview’s Data Security Investigations will include endpoint Data Loss Prevention (DLP) events as a queryable source, enabling admins to analyze related files automatically. Rolling out April–May 2026, this feature enhances investigation efficiency using AI tools without user impact or ...",
  "path": "/m365-message-center/message/mc1258000/",
  "publishedAt": "2026-03-22T01:00:17.000Z",
  "site": "https://blog.tophhie.cloud",
  "tags": [
    "558547",
    "Learn about Data Security Investigations | Microsoft Purview | Microsoft Learn",
    "Learn about Endpoint data loss prevention | Microsoft Purview | Microsoft Learn"
  ],
  "textContent": "**[Introduction]**\n\nWe’re introducing **endpoint Data Loss Prevention (DLP) events** as a **queryable data source** in _Data Security Investigations (DSI) in Microsoft Purview_. With this update, administrators can build endpoint DLP queries directly in DSI using filters such as date range, and DSI will automatically pull files associated with those events into the investigation for analysis. This integration helps security teams examine endpoint DLP activity at scale, reducing time and effort spent triaging individual alerts and improving the ability to identify patterns and potential data exfiltration scenarios.\n\nThis message is associated with **Microsoft 365 Roadmap ID** 558547.\n\n**[When this will happen]**\n\n  * **Public Preview:** Rollout begins in **late April 2026** and completes in **mid‑May 2026.**\n  * **General Availability (Worldwide):** Rollout begins in **mid‑May 2026** and completes in **mid‑May 2026**.\n\n\n\n**[How this will affect your organization]**\n\n_Who is affected_\n\nAdmins and security investigators using**Data Security Investigations (DSI)** and**endpoint Data Loss Prevention (DLP)** in the _Microsoft Purview compliance portal_.\n\n_What will happen_\n\n  * A**new Endpoint DLP tab** will appear in the _DSI search experience_ , alongside the existing Query Builder and Audit tabs.\n  * Admins and investigators can query endpoint DLP events using date range filters (additional filters coming soon).\n  * Files associated with matching endpoint DLP events will be automatically added to the investigation scope for analysis using DSI’s AI‑powered tools.\n  * This feature will appear automatically for eligible tenants when rollout completes. No admin action is required to enable it.\n  * There is no user impact.\n\n\n\n**[What you can do to prepare]**\n\nNo action is required. Optionally, you may:\n\n  * Review how endpoint DLP query capabilities work within DSI.\n  * Update internal documentation for alert triage and investigation workflows, if applicable.\n  * Inform security teams and endpoint DLP administrators about this new capability.\n\n\n\n**Learn more:**\n\n  * Learn about Data Security Investigations | Microsoft Purview | Microsoft Learn\n\n  * Learn about Endpoint data loss prevention | Microsoft Purview | Microsoft Learn\n\n\n\n**[Compliance considerations]**\n\n**Question**| **Answer**\n---|---\n**Does the change alter how existing customer data is processed, stored, or accessed?**| **Yes.** Endpoint DLP event data becomes queryable in DSI, and associated files are automatically collected into investigations for analysis.\n**Does the change introduce or significantly modify AI/ML capabilities that interact with customer data?**| **Yes.** DSI’s existing AI‑assisted investigation tools will now analyze files gathered through endpoint DLP queries.\n**Does the change modify how admins can monitor, report on, or demonstrate compliance activities?**| **Yes.** Admins gain new ways to surface, query, and analyze endpoint DLP signals within DSI.",
  "title": "MC1258000: Microsoft Purview: Data Security Investigations – analyze files tied to endpoint DLP alerts",
  "updatedAt": "2026-03-22T01:00:17.544Z"
}